Ohio Supreme Court Finds that Businessowners Insurance Policy Does Not Cover Ransomware Attack

Earlier this week, Ohio’s Supreme Court found that a Businessowners policy issued to a medical billing services company did not cover damage to the company’s software suffered in a ransomware attack.

In 2019, EMOI experienced a ransomware attack that encrypted the company’s files. Feeling that it was left with few other options, EMOI paid a ransom to the hackers to decrypt its files. Unfortunately, although EMOI could decrypt most of its files after paying the ransom, it could not decrypt all of its files despite its best efforts. As a result, in addition to the ransom, EMOI suffered losses for replacing and upgrading the software it could not decrypt.

Due to the attack, EMOI submitted a claim to its insurer, Owners Insurance Co., under its businessowners insurance policy. In its review of EMOI’s claim, Owners found that EMOI’s policy explicitly excluded coverage for ransom payments under its data compromise endorsement. It also found that coverage did not exist under the policy’s electronic equipment endorsement because EMOI did not suffer physical damage to its electrical equipment. As a result, Owners denied all coverage for EMOI’s claim. In response, EMOI filed a lawsuit seeking coverage for losses from the ransomware attack.

The electronic equipment endorsement in EMOI’s policy was at issue in the lawsuit. The endorsement stated that Owners would pay for direct physical loss or damage to EMOI’s media. The policy defined media as material that information is recorded on, such as film, magnetic tape, paper tape, disks, drums, and cards. However, the policy’s definition of media also included computer software and reproducing data on covered media. Based on the policy’s definition of media, EMOI argued that the policy covered damage to software alone. Unfortunately, the Court disagreed.

Although the definition of media in EMOI’s policy included computer software, the Court found that the endorsement could not cover damage to software alone. The Court found that software, by definition, could not experience physical damage because it does not have a physical existence. As a result, the Court found that the device on which the software was stored had to be damaged to be covered under the electronic equipment endorsement in EMOI’s policy.

It remains to be seen how influential the Court’s reasoning will be in other jurisdictions. The Court’s finding that the electronic equipment endorsement in EMOI’s policy could not cover software damage alone, based on the understanding that software cannot suffer physical damage, seems to contradict the explicit policy language and, at least, points to an ambiguity generally interpreted against the insurer.

As the incidence of ransomware attacks continues to grow, policy provisions like the electronic equipment endorsement in EMOI’s policy are likely to face more challenges as businesses look for ways to mitigate the growing risk of ransomware attacks.

The case is Emoi Servs., L.L.C. v. Owners Ins. Co., No. 2021-1529, 2022 Ohio LEXIS 2623 **1(Dec. 27, 2022).